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Abstract. Proving the unconditional security of a quantum key distribution (QKD) 
scheme is a highly challenging task as one needs to determine the most efficient 
attack compatible with experimental data. This task is even more demanding for 
continuous- variable QKD as the Hilbert space where the protocol is described is infinite 
dimensional. A very natural way to address this problem is to make an extensive use 
of the symmetries of the protocols. In this article, we investigate a symmetry in phase 
space that is particularly relevant to continuous- variable QKD, and explore the way 
towards a new quantum de Finetti theorem that would exploit this symmetry and 
provide a powerful tool to assess the security of continuous- variable protocols. 
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1. Introduction and motivation 

The greatest novelty brought by Quantum Key Distribution (QKD) is that, for the 
first time, a secret key agreement scheme can be proven unconditionally secure, that is, 
without making any assumptions about the power of an adversary. 

Even if this claim has been made repeatedly since the proposal of the first 
QKD protocol in 1984 [lj, it is only recently that complete proofs of security have 
been rigourously established. Proving the security of a scheme without making any 
simplifying assumptions is indeed quite challenging: the legitimate parties, Alice and 
Bob, need to infer what is the most efficient attack that an eavesdropper, Eve, could 
perform. This can be achieved by considering all bipartite states pab compatible with 
Alice and Bob's data, but this quickly becomes almost untractable since the dimension of 
the Hilbert space 7i® n relevant to describe pab grows exponentially with the number n of 
quantum signals exchanged during the protocol. As a consequence, security proofs were 
often derived while restricting the adversary to the so-called collective attacks. In such 
attacks, the state pab is supposed to be independent and identically distributed (i.i.d.), 
meaning that there exists a state o~ab £ T~C such that pab = &AB- As a consequence, 
the Hilbert space needed to analyze the protocol becomes H instead of 7i® n : no need 
to emphasize that this "small" assumption considerably simplifies the analysis ! 

The question then is to know whether such a hypothesis limits the power of the 
adversary in a non trivial way, or, said otherwise, whether this leads to an unreasonably 
optimistic view of the security of QKD. Fortunately, this is not the collective 
attacks were recently proven asymptotically optimal against protocols described with a 
finite-dimensional Hilbert space [2]. The main tool used to answer this problem was a 
quantum de Finetti theorem which can be roughly summarized as saying that a certain 
class of states in 7i® n , namely symmetric states, can be well approximated by mixtures 
of i.i.d. states. From a cryptographic point of view, this means that general symmetric 
attacks are almost the same as collective attacks. The last step to complete the proof is 
to show that a symmetric attack is optimal for the eavesdropper, or, equivalently, that 
the state pab can safely be assumed symmetric, which is indeed the case for most QKD 
protocols. 

The quantum de Finetti theorem is thus quite powerful as it allows to derive the 
security of a QKD scheme against arbitrary attacks as soon as its security against 
collective attacks is proven. Moreover, the full security is obtained almost for free, in 
the sense that the decrease of key size caused by allowing the adversary to perform 
any non- collective attack is negligible, at least in an asymptotic regime. In a finite size 
scenario, however, the impact on the key size could be significant, although it should 
be compared with other finite-size effects such as the precision of parameter estimation 
or the efficiency of error correction [3]. In this context, alternatives to the de Finetti 
theorem might also be worth investigating as they can lead to improved bounds [I]. 

Unfortunately, the application of the quantum de Finetti theorem that was 
presented in j2] is restricted to QKD schemes that are described in a finite-dimensional 
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Hilbert space. Apart from the fact that decribing any protocol in a finite-dimensional 
Hilbert space is nothing less than an approximation (even though quite a reasonable one 
for protocols involving qubits), it is clear that it does not apply to protocols genuinely 
described in infinite-dimensional Hilbert spaces such as protocols explicitly built on the 
continuous amplitude components of the light field (see [5] and references therein). The 
reason for this is that the quantum de Finetti theorem fails as soon as the dimension d 
of the Hilbert space 7i is not small compared to the number n of subsystems considered, 
which is obviously the case if d is infinite. Moreover, not only is the present version of 
the quantum de Finetti theorem limited to low dimensional Hilbert spaces, but counter- 
examples have been exhibited that demonstrate that a dimension-independent de Finetti 
theorem cannot exist [Bj. 

Nevertheless, the impossiblity of a general dimension-independent theorem does 
not rule out the possibility of more restricted versions of the theorem, which might still 
be highly relevant to prove the security of QKD schemes. In particular, the quantum de 
Finetti theorem of [2] is concerned with (permutation) symmetric states in H® n , that is, 
states that are invariant under arbitrary permutations of their n subsystems. The only 
approach that has been pursued to date in order to extend the range of application of 
this theorem to infinite-dimensional Hilbert spaces has consisted in restricting the set 
of states in such a way that a finite-dimension theorem can be applied [7J [8j [9j [11]. In 
particular, in [9], the quantum de Finetti theorem of [2] has been applied to infinite- 
dimensional quantum systems conditioned on certain measurement results. The main 
consequence is to rigorously justify the assumption of a finite-dimension theorem in the 
context of QKD protocols using attenuated coherent pulses as the support for qubits. 
The theorem can then be used to derive the security of some continuous- variable schemes 
[TO] as long as the energy of the signal states is not too important. The main drawback 
is that some experimental conditions need to be checked, which was not the case for 
finite-dimensional protocols. 

In this paper, we explore a radically different approach, which might greatly simplify 
the security proofs of continuous-variable QKD. The idea is to derive a new quantum 
de Finetti theorem corresponding to symmetry classes other than permutations of the 
subsystems. Our main insight is to describe the protocol in phase space instead of Fock 
representation, and to study a symmetry group that is specific to phase space. This 
choice features several advantages. First, the phase space representation is the natural 
choice for the analysis of continuous-variable QKD where the information is typically 
encoded onto the quadratures of the light field (see [5]). Moreover, if collective attacks 
are indeed asymptotically optimal as they generally are for discrete-variable QKD, it 
would be nice to have an interpretation of this result using covariance matrices. It should 
be pointed out that when restricted to collective attacks, the security of the protocol 
is completely characterized by the covariance matrix of the system shared by Alice and 
Bob [121 US]. Last but not least, the phase space representation has the remarkable 
property to be finite dimensional: one just traded a discrete description in a infinite- 
dimensional Hilbert space (the Fock representation) for a continuous description in a 
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finite-dimensional real space. 

Interestingly, in a classical setting, versions of the de Finetti theorem that apply 
to orthogonally-invariant continuous probability distributions have been known since a 
long time. Here, we make the first steps towards the generalization of this theorem 
to a quantum setting. Obviously, since a general dimension-independent quantum de 
Finetti theorem is impossible, we cannot hope to establish one just by switching between 
an infinite-dimensional state-space representation and a finite-dimensional phase-space 
representation. The trick is that the symmetry hypotheses needed for the phase-space 
de Finetti theorem are stronger than the ones used in the previous quantum versions 
of the de Finetti theorem. We will show that these stronger symmetry hypotheses are, 
however, perfectly compatible with continuous-variable QKD protocols. 

The outline of the paper is as follows. In Section [2J we explicitely make the link 
between symmetry properties and security proofs. In Section El we present continuous- 
variable QKD and introduce a new symmetry for such protocols. This symmetry is then 
presented in more details in Section HI where we make the preliminary steps towards 
the derivation of a new quantum de Finetti theorem for continuous variables. Finally, 
the conclusions are drawn in Section [51 

2. Role of symmetry in the security proofs 

The goal of this Section is to explain how symmetry considerations can simplify the 
theoretical analysis of quantum cryptography. In particular, we would like to provide a 
theoretical justification to the common attitude of considering the state pab shared by 
Alice and Bob as being symmetric. Note that a more mathematical argument can be 
found in [4]. 

As we mentioned previously, applying a de Finetti theorem to prove the security 
of QKD protocols works if one can first assume, without loss of generality, that the 
state pab is symmetric, that is invariant under any permutation of its n subsystems. 
Here, we show that this assumption is justified, but that one is actually not limited 
to considering the action of this particular symmetry group «S n (one can also consider 
larger symmetry groups). Basically, the idea is that by assuming any symmetry, Alice 
and Bob will always underestimate the secret key rate they can extract from their data. 

The secret key rate for a particular instance of a QKD protocol is a function of 
the state pab shared by the legitimate parties, Alice and Bob. The eavesdropper, Eve, 
is assumed to have the maximal information compatible with pab meaning that her 
state pe is such that pe = ^ab(\^abe)) where \^abe) is any purification of pab- 
Note that all purifications are equivalent up to a unitary operation applied on system 
E. More precisely, pab represents the knowledge that Alice and Bob have about the 
quantum state they share. For this reason, pab is subjective and inevitably depends 
on assumptions made by Alice and Bob. It must be emphasized that this cannot be 
avoided by performing a quantum tomography of the state since the latter is also subject 
to hypotheses, namely that one has access to an arbitrary large number of independent 
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and identical copies of a single state. The exponential version of the quantum de Finetti 
theorem as derived in j2] gives a partial answer to this problem: if pab is invariant under 
permutations of its subsystems, then it can be well approximated by a mixture of i.i.d. 
states, so quantum tomography is therefore justified. 

A crucial observation is that Alice and Bob would like to ignore or forget the 
properties of pab they are not interested in, typically possible correlations between 
the n subsystems of their state, hence obtaining pab = v®b for some prototype state 
o~ab £ W. Unfortunately, this action of forgetting comes at a price, namely erasing some 
potentially useful information. The first idea to make the argument more rigourous is 
that Alice and Bob can actually enforce the symmetry they want. Let us for instance 
consider symmetry under permutations of the subsystems of pab which is the symmetry 
commonly used in various QKD security proofs (with the notable exception of protocols 
such as the Differential Phase Shift (DPS) [H] or the Coherent One- Way (COW) [15]). 
This symmetry can be enforced in the following way: Alice and Bob can perform the 
same random permutation tc over their respective state, with tt being chosen uniformly 
over the symmetric group S n . This operation transforms Pab into 



where 7r is the unitary operator implementing the permutation 7r to both systems A and 
B, { | tt) }tt is an orthogonal family of vectors and C is a classical auxiliary space whose 
sole purpose is to store the information concerning the permutation 7r that was applied. 
Then, tracing over system C (or equivalently giving this system to Eve), Alice and Bob 
obtain the state pab, which is symmetric by construction. Obviously, for any practical 
purpose, applying such a procedure is out of question as it would at least involve a 
quantum memory in order to store each subsystem while Alice and Bob wait for the 
total state pab- One may object, however, that applying such a permutation n to pab 
is equivalent to merely relabeling the indices of Alice and Bob's data, which is much 
simpler to implement. The key is that both procedures are indistinguishable, which is 
a clear consequence of the fact that the permutation of subsystems commutes with the 
measurement procedure and classical post-processing. This is true for most protocols, 
such as BB84 or continuous-variable protocols, but not for DPS or COW. In order for 
the two procedures to be completely equivalent, Alice and Bob should completely forget 
which particular permutation was performed. A second crucial point is that, in reality, 
Alice and Bob do not even need to permute the labels of their data. What is really 
necessary is that they should never use any information related to the order of their 
data (the labeling of their data) when they extract the key. 

It must be realized that enforcing such a symmetry can only decrease the secret 
key rate since Alice and Bob give additional information to Eve, or, equivalently, forget 
some a priori available information. On the other hand, while they are only throwing 
information that they do not know use in practice (the labeling of their data), the impact 
of this symmetrization step to the key rate is actually negligible. Note than nothing 
forbids one to use such a technique in the study of the DPS and COW protocols. 
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However, correlations between different subsystems are essential for these protocols to 
work and no key could be extracted if one was forgetting them. In principle, any 
symmetrization is applicable to any QKD protocol, but some symmetrization procedures 
essentially erase all the relevant information and are consequently useless for the study of 
such protocols. Other symmetries have been investigated in the literature, for instance 
random bit-flip or phase-flip applied simultaneously by Alice and Bob, and have led to 
simplifications in the analysis of some protocols [16J. 

The above reasoning can easily be generalized to other symmetries. Let Q be a 
symmetry group in H® n . Alice and Bob can perform a random g drawn from Q and 
later forget about g, thus transforming pab into 



where j^Q is the cardinal of Q. The group Q can even be continuous, in which case the 
discrete sum should simply be replaced by an integral over the Haar distribution of Q. 
This is actually what we will do for continuous-variable protocols. 

3. Phase-space symmetry for continuous-variable QKD 

3.1. Brief summary of the theoretical analysis of continuous-variable QKD 

We rapidly describe continuous-variable protocols, as a more detailed presentation can 
be found in [5]. Continuous- variable QKD comes with two flavours depending on 
whether the quantum state shared by Alice and Bob is characterized by a quantum bit 
error rate (QBER) or by a covariance matrix. In the first category lie protocols where 
the quadratures of the light field are just the support for encoding bits. Such protocols 
usually use postselection to improve their QBER [17]. Then, the analysis is somewhat 
similar to that of discrete-variable protocols. In the second category of protocols such 
as [18], with which we are only concerned here, the quantum state shared by Alice and 
Bob is characterized by its covariance matrix. This means that the continuous-variable 
approach is used even for the description of the state, and not only as a means to carry 
information over quantum channels. This approach has an important drawback, namely 
that postselection is a priori impossible: one must keep all data. This is particularly 
damaging during the classical post-processing of the protocol where one now has to deal 
with real random variables instead of binary random variables. The main implication 
is that the reconciliation step, which roughly corresponds to correcting discrepancies 
between Alice and Bob's classical data, becomes a task that is much more involved 
than correcting errors between two binary strings. The error rate may indeed be much 
higher as the protocols with continuous variables may tolerate very low signal-to-noise 
ratio. The classical problem of reconciliation was until recently limiting the range of 
continuous- variable QKD protocols [15] . However, simpler discrete modulation schemes 
can help dealing with the reconciliation problem [10J. 



Pab = tr ch^E 9 Pab 9 j ® \g) (g\ 
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3.2. Rotation symmetries for continuous-variable QKD 

One of the nice features of continuous- variable QKD is that the security against collective 
attacks is entirely characterized by the covariance matrice of pab- As we restrict our 
analysis to collective attacks, one has pab — °"ab> ano - the covariance matrix V of o~ab 
is usually assumed to be of the form: 

r = ( Xl2 ZOz \ (i) 

sym ^ Za z Yl 2 )' [ } 

where o~ z = diag(l, — 1). Note that this form can easily be understood from an 
experimental point of view since the quantum channel is not supposed to induce 
correlations between different quadratures, for instance, but no theoretical justification 
has been given so far. Here, we use the ideas explained in previous section to prove that 
T can indeed be supposed to take this simple form. 

Since we make the assumption of a collective attack, the covariance matrix T is well 
defined and can be estimated by Alice and Bob. The most general form for T is: 



(2) 



The idea is that Alice and Bob can perform some symmetrization operation, which 
transforms T into r sym . First, note that their classical data are two strings x,y G M n , 
which correspond to the results of homodyne measurements of the various quadratures 
of Pab- The reconciliation is always optimized for a Gaussian channel, meaning that 
the random variable y is modelled as y = tx + z [19] where t is a transmission factor 
and z is a random variable modelling the added noise and characterized by its variance 
a 2 . Therefore, the reconciliation procedure would not be affected if Alice and Bob both 
performed the same random orthogonal transformation R G O(n) to their respective 
data, since one would then have Ry = tRx + z', where z' is a rotated noise with the same 
variance a 2 . If Alice and Bob apply such a random orthogonal transformation (rotation) 
and forget which one has been performed, their data become "symmetric" in the sense 
that the matrix T takes the form of r sym where X = (Xn + X22V2, Y = (Yu + Y 2 2)/1 
and Z = [Z\\ — Z 2 2)/2. The fact that the covariance matrix r sym features Zo~ z instead 
of ZI2 simply reflects the fact that r sym is not the covariance matrix of the classical 
data of Alice and Bob in the prepare- and-measure scenario, but the covariance matrix 
of pab in the equivalent entanglement-based scenario. In the latter case, Alice and Bob 
would actually apply conjugate orthogonal transformations to their respective share of 
the state instead of the same transformation. By conjugate transformation, we mean the 
transformation whose corresponding 2n x 2n matrix in phase space is obtained from the 
original one by flipping the sign of all rows whose label corresponds to a p quadrature 
and then flipping the sign of all columns whose label corresponds to a p quadrature. 
This can be understood by considering a two-mode squeezed vacuum, which is the 
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state characterizing the inherent symmetry of continuous-variable QKD: this state has 
a covariance matrix r sym where Y = X and Z = \/X 2 — 1, and is invariant under 
conjugate orthogonal transformations performed by Alice and Bob. 

As we will see, this new symmetrization (based on orthogonal transformations in 
phase space instead of permutations in state space) has several crucial consequences. 
First, it allows us to rigorously prove that Alice and Bob can safely assume their 
covariance matrix to have a simple structure, characterized by only three parameters 
which are easily estimated experimentally (this was done until now with no firm 
theoretical justification). The second consequence, which we will study in the next 
Section, is that it gives a simple structure to the state pab which enables us to investigate 
the unconditional security using a de Finetti approach. 

4. Invariant states under rotations in phase space 

The goal of this Section is to give some insights on the structure of the states which 
are invariant under orthogonal transformations in phase space. More precisely, if Alice 
and Bob perform n homodyne measurements on pab (Alice and Bob are assumed to 
measure the same quadrature since they discard the data corresponding to measurements 
of incompatible quadratures), they obtain two random vectors x,y G MJ 1 . We are 
interested in unitary transformations whose effect on pab is described by an orthogonal 
transformation on the probability distributions of x and y. As these probability 
distributions are completely characterized by the Wigner function of Pab, the states 
of interest are simply those whose Wigner function is invariant under such symplectic 
t r ansf or mat ions . 

Before describing the bipartite case, it is useful to consider first the single-party 
case, where the state of Bob is traced out. 

4-1. Single party case 

Here, we are interested in generalizing the concept of orthogonally invariant probability 
distributions to the quantum setting, that is, to Wigner functions. A n-mode state p 
is termed orthogonally invariant in phase space if it is invariant under the action of 
any n-mode Gaussian unitary operator corresponding to a real symplectic orthogonal 
transformation (or, simply said, a rotation) in the 2n-dimensional phase space of p. 
Physically, this means that p remains unchanged after being processed via any n-mode 
passive linear interferometer. The set of such orthogonally invariant states is convex 
and is therefore characterized by its extremal points, namely the states 




S.t. ki — h 

where \ki • • • k n ) is the n-mode Fock state with ki photons in mode i and a£ 



(n+k-l\ 
\ n-1 J' 
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Physically, these extremal states are (proportional to) the projectors onto the 
different eigenspaces of the total number operator n = fi\ + • ■ ■ n n labelled with the 
integer parameter k, corresponding to the total number of photons distributed over the n 
modes. The normalization constant a£ simply counts the number of ways of distributing 
k photons into n modes. These extremal states cr^ form a discrete infinite set of mixed 
states. Importantly, any pure eigenstate chosen in the eigenspace corresponding to a 
given total photon number k is generally not orthogonally invariant; only the uniform 
mixture of them fulfills this invariance (Schur's lemma), which is why the extremal 
states are mixed for n > 1. Finally, any state p that is invariant under orthogonal 
transformations in phase space can be written as 



where the weights satisfy < < 1 and J2k c k = 1- 

4-2. A Gaussian quantum de Finetti theorem for rotation-invariant states 

Let us now introduce a classical de Finetti theorem for continuous variables. An infinite 
sequence of real- valued random variables X\, ■ • • , X n • • • is called orthogonally invariant 
if, for every n, the probability distribution of X\, ■ ■ • , X n is invariant under all orthogonal 
transformations of ~R n . It was proven in [201 [2TJ that orthogonally invariant distributions 
are exactly mixtures of i.i.d. normal distributions. 

This result holds only approximately for finite sequences: if X%, • • • , X n is invariant 
under orthogonal transformations of M™, then there exists a mixture of i.i.d. normals 
such that its variation distance to the marginal law of the first k coordinates of 
Xi, ■ ■ ■ , X n is bounded by Oikjn) for k <C n |22j. This cannot be directly applied 
to quantum systems, however, since Wigner functions are not necessary legitimate 
probability distributions (they can be negative). Here, we prove that this generalization 
is nevertheless correct in the asymptotic regime. In particular, we prove that an 
orthogonally invariant state tends to a mixture of multimode thermal states, which 
are products of n thermal states with the same mean photon number. 

Let us consider an n-mode state p which is orthogonally invariant in phase space. 
For any iV > n, p is the partial trace over (N — n) modes of an iV-mode orthogonally 
invariant state p^ N \ As stated above, p^ is a convex mixture of the states . 
Therefore, it is enough to prove that the trace over (N — n) modes of aj? becomes 
asymptotically close (for the trace distance) of a multimode thermal state as N tends 
to infinity. Since the state of interest trAr_ n as well as the "target" n-mode thermal 
state p™ h (x) with k/n photons per mode are orthogonally invariant, they can both be 
written as mixtures of cr"'s, 
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with 



n „N—n 



f(l) = 9(1) ~ «, 



(k/N) 1 



Note that / and g also depend on k, n, and N, but we do not mention these parameters 
explicitly in order to simplify the notations. The trace distance between the two states 
is given by the variation distance between the two classical probability distributions / 
and g 

CO 

ntr*-„ ^-pr h iii = £i/(o-<?(oi- 

1=0 

The second member can be bounded from above as 

±m-M-±\§-i\*>->±{§-yM 
5 2 {"?§- 

where the last inequality follows from the triangle inequality, and (x) + stands for x if 
x > and if x < 0. Let us introduce the notation 

f(l) a£_7 w (1 + (k/N)r+ l 



MO = = >< 



9(1) < (W ' 

The rest of the proof consists in approximating sup h in the asymptotic regime. This is 
done by using the asymptotic approximation of a^™ with n — > oo resulting from Stirling's 
formula, namely 



xn ' nx 



l + V/ X 2 ynG(x/y) 



where G(z) — (z + 1) log 2 (2 + 1) — zlog 2 (z) is the von Neumann entropy of a thermal 
state with z photons. Let us introduce the reduced variables x = k/N, y = n/N, 
z = l/N and t — (1 — y)/(x — z). We can approximate the function of interest h(l) as 

Nt(x-z) 



a„r~V (i + x )N(y+z) 

Kzn) = " (l 



where 



and 



x(l + t) / tx(l + t) 



(x-z)(l + l/x) V (1 -y)(l + l/x) 



B = (1 - j/)0(l/f) - s(x) + (y + z) log(l + x) - z log(x). 

Deriving with respect to z, one has 
OB 

— = -log(l + t) + log(l + l/rr). 
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Therefore, B is extremal for t = 1/x, that is z = xy, giving B < 0. As a result, one has 

j 11 

sup hit) = sup h(zN) ~ —== ~ 1 H — for n -C N. 

i z v 1 - y 2N 

Hence, 1 1 tr^— n o~k — p"J |i ^ for ^ oo, which proves the quantum continuous- 
variable version of the de Finetti theorem for orthogonally invariant states in the 
asymptotic regime. 

4-3. Bipartite case 

So far, we only discussed single-partite orthogonally-invariant states. Obviously, in order 
to use this approach to the study of QKD security, one needs a bipartite generalization. 
Let us consider the case of a 2n-mode bipartite state Pab, meaning that Alice and Bob 
each have n modes. Such a state pab is termed invariant under conjugate orthogonal 
transformations in phase space if, for any Gaussian unitary operation U corresponding 
to a real symplectic orthogonal transformation in Alice's 2n-dimensional phase space, 
it satisfies 

U ®U* pab U ] ®U T = p AB 

where U* is the Gaussian unitary operation corresponding to the conjugate orthogonal 
transformation in Bob's phase space. Physically, this invariance means that pab remains 
unchanged when Alice processes her n modes into any passive linear interferometer while 
Bob processes his n modes into the passive linear interferometer effecting the conjugate 
rotation in phase space. 

Ideally, one should have a quantum de Finetti theorem for bipartite orthogonally 
invariant states since this is the case which is directly relevant for proving the security 
of continuous- variable QKD. The reason is that, following the arguments in Section 
[2j Alice and Bob can indeed assume their bipartite state pab to be invariant under 
conjugate orthogonal transformations. Thus, a bipartite quantum de Finetti theorem 
would rigorously prove that pab is "close to" a product of Gaussian states. Note, 
however, that an exponential version of the theorem would actually be required to 
address the security of continuous- variable QKD, meaning that it is enough to trace 
over only an exponentially small number of modes in order to get a good approximation 
by a Gaussian state. Then, such a Gaussian state would actually be the product of n 
i.i.d. Gaussian states, and the security against collective attacks would therefore imply 
the security against arbitrary attacks. 

Finding a bipartite version of this quantum de Finetti theorem is the subject 
of further work. Although we do not have a rigorous proof yet, the fact that a 
bipartite version of the theorem holds is very likely. In particular, both partial traces 
Pa = tr B pab and ps = to a pab are single-partite orthogonally- invariant states, 
for which the theorem applies. Hence, locally, we already know that a state pab 
that is invariant under conjugate orthogonal transformations in phase space becomes 
asymptotically Gaussian. One only needs to prove that the correlations between Alice 
and Bob also behave according to the bipartite version of the theorem. 
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5. Conclusion and perspectives 

We have discussed the role of symmetries in the security analysis of QKD, and 
introduced a new symmetry that is especially suited to continuous-variables schemes. 
This symmetry, which can be spelled out in the phase space representation, encompasses 
the usual symmetry under permutations in state space that have been considered so 
far in the context of discrete-variable QKD. We then derived an asymptotic quantum 
de Finetti theorem for orthogonally-invariant states in phase space, and showed that 
Gaussian states play a role similar to that of i.i.d. states in the usual de Finetti theorem. 
More precisely, any orthogonally-invariant state can be shown to be asymptotically close 
to a mixture of product Gaussian (thermal) states. This first application of a symmetry 
in phase space to the QKD security analysis seems very promising as Gaussian states 
have been known to play a fundamental role in the analysis of continuous- variable QKD. 

The perspectives of this work towards proving the unconditional security of 
continuous-variable QKD are twofold. A first approach would be to study the 
generalization of our (asymptotic) continuous-variable quantum de Finetti theorem 
in phase space to the bipartite scenario, and then investigate whether an exponential 
version can be derived. The second option would be to see if the techniques recently 
introduced in [I] can be generalized to continuous variables. 
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